APT37 / ScarCruft

Overview

APT37 / ScarCruft is North Korea's primary domestic intelligence collection apparatus in cyberspace — a unit assessed to operate under the Reconnaissance General Bureau (RGB) with a mission that is narrower and more focused than North Korea's other hacking groups. Where Lazarus Group pursues financial theft and Kimsuky conducts broad geopolitical intelligence gathering, ScarCruft's core mandate is surveillance of the South Korean population and anyone engaged with North Korean affairs: government officials, academics studying the regime, journalists covering the DPRK, human rights workers supporting defectors, and the defector community itself.

This targeting reflects a specific Pyongyang intelligence priority: understanding how South Korean society perceives the regime, tracking defectors who may be sources for foreign intelligence services or media, and monitoring the individuals and organizations that shape South Korean and international policy on North Korea. A journalist who interviews defectors, an academic whose research informs ROK government positions on reunification, a think tank analyst whose publications feed into US policy — these are all primary ScarCruft targets. SentinelLabs captured the group's purpose precisely in 2023: ScarCruft's operations are designed to "gather strategic intelligence that can contribute to North Korea's decision-making processes" and to help the group "gain a better understanding of how the international community perceives developments in North Korea."

The group has been active since at least 2012 and has remained continuously operational through 2025, documented in multiple campaigns as recently as September 2025 (Operation HanKook Phantom targeting National Intelligence Research Association members) and December 2025 (Ruby Jumper, which introduced USB-based air-gap bridging). This longevity reflects an organization that is consistently resourced, consistently tasked, and has built a sophisticated operational cadence that generates actionable intelligence for the regime on an ongoing basis.

ScarCruft's distinctive technical signature is its consistent abuse of legitimate cloud services for command and control — routing C2 traffic through Dropbox, Google Drive, OneDrive, pCloud, Yandex Cloud, and most recently Zoho WorkDrive. This approach makes network-level detection of ScarCruft activity extremely difficult in enterprise environments where these services are regularly used for legitimate purposes. The group combines this cloud C2 infrastructure with a consistent pattern of IE/Edge scripting engine zero-days — exploiting the legacy Internet Explorer rendering engine embedded in applications and older Edge configurations — giving it reliable initial access against South Korean targets who use software that still incorporates IE-based rendering components.

The Intelligence Mission: Why Defectors and Journalists

Understanding ScarCruft requires understanding what Pyongyang actually wants from it — and why the targets it consistently pursues are strategically valuable to the North Korean state.

• Defector Surveillance: North Korean defectors — particularly those who have become public figures, policy advocates, or sources for journalists and intelligence services — represent a direct threat to the regime in multiple ways. They provide testimony about conditions inside North Korea, they often maintain contact networks with family members still in the DPRK, and some become sources for South Korean and US intelligence. ScarCruft's surveillance of defectors and the NGOs supporting them provides Pyongyang with visibility into who these individuals are in contact with, what information they are sharing, and potentially how to identify their family members inside North Korea for leverage or punishment. A compromised defector advocacy organization's email server gives the regime a complete map of its defector network.
• Journalists and Media Organizations: North Korea-focused journalists and the outlets they work for are persistently targeted. The intelligence value is twofold: understanding what information journalists have obtained before it is published (allowing the regime to prepare countermeasures or dismiss it as fabricated), and identifying the sources those journalists are using — which may include current or former North Korean officials, defectors, or ROK government contacts. ScarCruft's documented targeting of Daily NK (a South Korean online news outlet focused on North Korean affairs) and academic media organizations reflects this priority.
• Academics and Think Tank Researchers: South Korean and foreign academics who study North Korea — their policy positions, their research methodologies, their data sources, and their networks of contacts — feed directly into ROK government and US policy. A think tank analyst whose research informs South Korean or American positions on negotiations, sanctions, or military posture is a valuable intelligence target. ScarCruft specifically targeted individuals associated with national intelligence research associations — organizations whose work directly informs government decision-making.
• Cybersecurity Professionals: A more recently documented targeting category: ScarCruft has been observed using threat research reports as decoy documents in spear-phishing attacks against cybersecurity professionals. SentinelLabs noted in 2023 that ScarCruft's "focus on consumers of technical threat intelligence reports suggests an intent to gain insights into non-public cyber threat intelligence and defense strategies" — specifically, to understand what the cybersecurity industry knows about ScarCruft's own operations, and to identify detection methods that would allow the group to update its tradecraft before those methods are widely deployed.

Zero-Day Exploitation Pattern: IE as a Persistent Attack Surface

ScarCruft has maintained an unusual and consistent focus on Internet Explorer zero-day vulnerabilities across multiple years — a targeting choice that at first appears anachronistic given Microsoft's formal retirement of IE, but that reflects a specific understanding of the South Korean software ecosystem.

• Why IE After Retirement: Internet Explorer was officially retired by Microsoft in June 2022, but its rendering engine (Trident/MSHTML) and its successor JavaScript engine (JScript9, used in Edge's IE Mode) remain embedded in a significant number of applications — particularly commercial and government software common in South Korea. Applications that use WebView components, legacy enterprise software with IE-based rendering, and Edge running in IE compatibility mode all provide attack surfaces for exploits targeting the IE scripting engine. ScarCruft consistently identifies and exploits vulnerabilities in these components because the targets it pursues in the South Korean government, academic, and media sectors are likely users of affected software configurations.
• CVE-2022-41128 (JScript9 Type Confusion): Discovered by Google TAG in late October 2022. A type confusion vulnerability in the JScript9 engine — the same engine used in Internet Explorer — exploited by ScarCruft via malicious Microsoft Office documents that fetched remote RTF templates, which in turn loaded HTML content rendered by Internet Explorer. The malicious document used the Itaewon Halloween crowd crush (October 29, 2022) as a lure. Google reported the vulnerability to Microsoft on October 31 and patches were released November 8, 2022 — a nine-day window during which ScarCruft exploited the zero-day against South Korean targets.
• CVE-2024-38178 — Operation Code on Toast (May 2024): A memory corruption bug in the Windows Scripting Engine affecting Edge in Internet Explorer Mode. ScarCruft delivered this zero-day through a novel vector: compromised "toast" notification advertisement programs — free software widely installed among the South Korean public that displays pop-up notifications and uses IE-based rendering for ad content. Users who had these legitimate advertisement applications installed were silently exploited simply by having the application run — a zero-click or near-zero-click exploitation mechanism that required no user interaction beyond having the vulnerable software running. AhnLab and South Korea's National Cyber Security Center discovered and reported the campaign; Microsoft patched it in August 2024.

Ruby Jumper: Air-Gap Bridging (December 2025)

The Ruby Jumper campaign, discovered by Zscaler ThreatLabz in December 2025, represents the most significant capability escalation in ScarCruft's documented history. It introduced a complete air-gap bridging toolkit — a set of malware components specifically designed to move commands and data between internet-connected systems and physically isolated systems that have no network connectivity.

Air-gapped systems are the highest-security tier in any sensitive organization. Military systems, intelligence agency networks, classified government databases, and sensitive research environments may be physically isolated from the internet — no Wi-Fi, no Ethernet, no network connections of any kind — relying entirely on removable media for any data transfer. The assumption is that network-level attacks cannot reach these systems. Ruby Jumper is designed to defeat that assumption.

• Infection Chain: The attack begins with a malicious Windows shortcut (LNK) file — consistent with ScarCruft's long-established LNK delivery preference. When opened, the LNK silently launches PowerShell which carves multiple embedded payloads from fixed offsets within the shortcut file itself. The December 2025 campaign used an Arabic-language decoy document about the Israel-Palestine conflict translated from North Korean media — indicating targeting of individuals monitoring North Korean media narratives, possibly in Middle Eastern or international policy contexts.
• RESTLEAF — First-Stage Implant: A Windows implant that communicates with operators via Zoho WorkDrive — the first documented case of ScarCruft abusing Zoho's cloud platform for C2. RESTLEAF uses hardcoded OAuth tokens to authenticate to Zoho WorkDrive and downloads shellcode from a folder named "Second." It signals active infection to operators by dropping timestamped "lion [timestamp]" beacon files in the Zoho WorkDrive folder. The shellcode is injected into memory via process injection, leaving minimal on-disk artifacts.
• SNAKEDROPPER — Ruby Runtime Installer: A second-stage component that installs a complete, self-contained Ruby 3.3.0 runtime in the ProgramData directory — renaming the Ruby interpreter executable from rubyw.exe to usbspeed.exe to appear as a USB utility and evade process-based detection. SNAKEDROPPER replaces a standard Ruby file with malicious code and creates a scheduled task named "rubyupdatecheck" for automatic execution. All payloads are encrypted with a one-byte XOR routine and executed reflectively in memory.
• THUMBSBD / VIRUSTASK — Air-Gap Bridge Components: The operationally critical components. VIRUSTASK targets removable drives: it hides the legitimate files on any inserted USB drive and replaces them with malicious shortcuts. When a victim using an air-gapped system inserts a USB drive and clicks on what appears to be their files, the disguised Ruby interpreter executes embedded shellcode, infecting the air-gapped host. THUMBSBD manages the command relay between the internet-connected and air-gapped systems — using the USB drive as a bidirectional channel for commands and exfiltrated data. A command staged in Zoho WorkDrive on the internet-connected system can be relayed via USB to the air-gapped system, and data exfiltrated from the air-gapped host can be carried back via USB for upload.
• FOOTWINE — Surveillance Backdoor: The final payload on both internet-connected and air-gapped systems, disguised as foot.apk (an Android package file). FOOTWINE supports keylogging, screenshot capture, audio recording, webcam monitoring, file manipulation, registry access, and remote shell execution. C2 communication uses a custom XOR-based key exchange protocol over TCP to 144.172.106[.]66:8080. The disguise as an APK file — a format that Windows security tools may not scan as aggressively as native PE executables — provides additional evasion.
• BLUELIGHT: The previously documented ScarCruft backdoor is also deployed in the Ruby Jumper chain. BLUELIGHT uses multiple legitimate cloud storage providers — Google Drive, Microsoft OneDrive, pCloud, and Backblaze — for C2 operations. It supports arbitrary command execution, file system enumeration, payload download, file upload, and self-removal to reduce forensic artifacts.

Target Profile

• North Korean Defectors and Defector Support Organizations: The highest-priority consistent target category. Defectors who have become public figures, media sources, or NGO participants, along with the organizations supporting them, provide Pyongyang with visibility into the defector community and the information networks surrounding it.
• South Korean Academic Researchers: Academics at South Korean universities studying North Korean affairs, national security, intelligence policy, and Korean unification. Documented campaigns targeted the National Intelligence Research Association and individuals associated with national security research communities. Operation HanKook Phantom (September 2025) specifically targeted individuals associated with South Korean national intelligence research.
• North Korea-Focused News Organizations: South Korean and international media outlets covering North Korea — including the documented targeting of Daily NK (a South Korean outlet with inside sources from the DPRK). December 2023 campaigns targeted a North Korea-focused news organization alongside academic experts, according to SentinelLabs.
• South Korean Government and Military: Government officials, military personnel, and entities connected to South Korean national security are targeted alongside civilian targets. Operation Daybreak (2016) targeted South Korean government and military organizations.
• Cybersecurity and Threat Intelligence Professionals: An increasingly prominent targeting category. ScarCruft has used threat research reports as decoy documents — including a fake report on Kimsuky — to target cybersecurity professionals. The intelligence value is understanding non-public detection methods and threat intelligence that could compromise ScarCruft's own operations.
• International Targets with DPRK Exposure: Beyond South Korea, ScarCruft has targeted organizations in Japan, Vietnam, Russia, Nepal, China, India, Romania, Kuwait, and Middle Eastern nations — anywhere that has strategic relevance to North Korean interests. The Ruby Jumper campaign's Arabic-language decoy suggests targeting in Middle Eastern contexts. The NPO Mash breach (2021) targeted a Russian missile technology research firm.
• Korean-Speaking Android Users — KoSpy: The KoSpy Android spyware campaign (2022–2024) targeted Korean and English-speaking users via fake utility apps on the Google Play Store — including apps masquerading as a "File Manager," "Software Update Utility," and "Kakao Security." KoSpy collected SMS messages, call logs, GPS location, device files, audio recordings, and screenshots via dynamically loaded plugins.

Tactics, Techniques & Procedures

mitre id	technique	description
T1566.001	Spear-Phishing — Geopolitical Lures	ScarCruft's primary initial access technique. Spear-phishing emails are precisely targeted to the recipient's known interests — a researcher receiving a document about North Korean troop deployments to Russia, a national security academic receiving what appears to be a conference invitation, a cybersecurity professional receiving a report on Kimsuky. The high relevance of lures to target interests increases open rates and reduces suspicion. Delivery vehicles include LNK files (the current preferred format), HWP (Hangul Word Processor) documents for South Korean government targets, malicious Office documents fetching remote templates, and oversized LNK files embedding full RokRAT payloads. Recent campaigns used Kim Yo Jong statements and national intelligence newsletter themes as lures.
T1189	Drive-by Compromise — Strategic Web Compromises	ScarCruft compromises websites specifically visited by its target populations — South Korean online news outlets covering North Korea, community forums for defectors, and industry portals. The Daily NK watering-hole attack (2021) exploited CVE-2020-1380 and CVE-2021-26411 via injected JavaScript, delivering Cobalt Strike and BLUELIGHT to readers of the outlet. The Operation Code on Toast vector (2024) extended this approach to compromised advertisement server infrastructure, delivering CVE-2024-38178 exploitation to users of widely-installed free software that displays toast notifications using IE-based rendering.
T1189 / T1203	IE/Edge Zero-Day Exploitation — Scripting Engine	ScarCruft maintains a consistent focus on Internet Explorer and Edge scripting engine vulnerabilities — a pattern documented across CVE-2020-1380, CVE-2021-26411, CVE-2022-41128, and CVE-2024-38178. The exploitation targets the JScript9 or Scripting Engine components embedded in applications that use IE-based rendering, including legacy enterprise software, document viewers, and advertisement programs common in the South Korean market. The Operation Code on Toast (2024) delivery via toast ad software was notable as a near-zero-click mechanism — users with vulnerable advertisement software installed were exposed without clicking any phishing link.
T1102	Web Service — Cloud C2 Infrastructure	ScarCruft's most distinctive evasion technique: routing all C2 communication through legitimate, widely-used cloud services. RokRAT uses Dropbox, Google Cloud, pCloud, and Yandex Cloud. BLUELIGHT uses Google Drive, Microsoft OneDrive, pCloud, and Backblaze. RESTLEAF (Ruby Jumper) uses Zoho WorkDrive. This approach makes network-level detection extremely difficult in enterprise environments where these services are in routine use — C2 traffic is indistinguishable from legitimate cloud storage synchronization. Blocking these services entirely as a defensive measure would disrupt legitimate business operations. Detection requires endpoint-based process monitoring to identify which processes are generating the cloud storage connections, rather than connection destination monitoring.
T1091	Replication Through Removable Media — Ruby Jumper Air-Gap Bridge	The December 2025 Ruby Jumper campaign introduced a complete USB-based air-gap bridging toolkit. VIRUSTASK infects USB drives by hiding legitimate files and replacing them with malicious shortcuts. When an air-gapped system user inserts the infected USB drive and opens what appears to be their files, the disguised Ruby interpreter delivers shellcode to the isolated system. THUMBSBD manages bidirectional command-and-data relay between internet-connected and air-gapped hosts via the USB drive as a physical channel. This tradecraft is directly targeted at environments where network isolation is the assumed primary security control.
T1027	Obfuscated Files — Steganography and Encoding	ScarCruft uses steganography to embed malicious code or C2 configuration data within seemingly benign image files. The group also employs PowerShell-based fileless execution, one-byte XOR encryption of payloads for in-memory decryption, and reflective loading — executing payloads directly in memory without writing executable files to disk. Ruby Jumper's use of one-byte XOR with in-memory execution across all payload stages reduces the forensic artifact surface available for detection. The disguise of FOOTWINE as an APK file further evades file-type-based security controls.
T1547.001	Boot/Logon Autostart — Scheduled Tasks	Persistence via scheduled tasks is ScarCruft's documented persistence mechanism in recent campaigns. Ruby Jumper specifically creates a scheduled task named "rubyupdatecheck" for automatic execution of the Ruby-based malware chain. Earlier campaigns used Windows Registry run keys and service creation for persistence. The scheduled task approach is consistent with the group's preference for blending malicious activity with legitimate system maintenance patterns — a task named "rubyupdatecheck" is superficially plausible as a legitimate software maintenance task.

Known Campaigns

Tools & Malware

• RokRAT: ScarCruft's signature long-running backdoor, deployed consistently since at least 2017. RokRAT provides remote access, system information collection, arbitrary command execution, file system enumeration, screenshot capture every three minutes, keystroke logging, and clipboard monitoring. C2 exclusively via legitimate cloud services: Dropbox, Google Cloud, pCloud, and Yandex Cloud. Configured to use Yandex Cloud by default with fallback to other providers. The cloud C2 approach makes RokRAT traffic blend with regular enterprise traffic patterns. Delivered via LNK files, HWP exploits, Office documents, and zero-day exploitation depending on campaign.
• BLUELIGHT: A full-featured backdoor using Microsoft Graph API / OneDrive, Google Drive, pCloud, and Backblaze for C2. Capabilities include arbitrary command execution, file system enumeration, additional payload download, file upload, and self-removal to reduce forensic evidence. First documented in a watering-hole attack on Daily NK. Reused in the Ruby Jumper campaign alongside the new toolkit. The multi-cloud C2 flexibility means disabling one cloud provider does not interrupt C2 access.
• Dolphin: A more capable backdoor documented by ESET in 2022, providing extensive surveillance: drive monitoring, file exfiltration, keylogging, screenshot capture, and browser credential theft from Chrome, Edge, and Internet Explorer. Deployed against specific high-value targets after initial access is established with lower-tier tools.
• Chinotto: A PowerShell-based backdoor used for reconnaissance and second-stage payload download. Delivered via CHM files, malicious LNK files, and other document-based vectors. Used consistently across multiple campaign years as a lightweight first-stage reconnaissance tool.
• GOLDBACKDOOR: A cloud-connected backdoor using Microsoft OneDrive for C2, documented in 2022 campaigns targeting North Korean affairs journalists and political activists.
• RESTLEAF / SNAKEDROPPER / THUMBSBD / VIRUSTASK / FOOTWINE: The five new components introduced in the December 2025 Ruby Jumper campaign. RESTLEAF (Zoho WorkDrive C2 first-stage), SNAKEDROPPER (Ruby runtime installer and persistence), THUMBSBD and VIRUSTASK (USB air-gap bridge components), and FOOTWINE (full surveillance backdoor with keylogging, audio/video capture, remote shell). See the Ruby Jumper section above for complete technical details.
• KoSpy: Android spyware distributed via Google Play and third-party stores. SMS, calls, location, files, audio, screenshots. Firebase Firestore for initial C2 configuration. Korean and English language support. Active 2022–2024.
• BabyShark: A Visual Basic Script-based malware family used in campaigns targeting US policy think tanks in 2021. Primarily a reconnaissance and data exfiltration tool for the early stages of an intrusion.

Indicators of Compromise

IOCs from AhnLab/NCSC Operation Code on Toast analysis, SentinelLabs 2023 ScarCruft research, Seqrite Operation HanKook Phantom, Zscaler ThreatLabz Ruby Jumper analysis (December 2025), and Lookout KoSpy disclosure. Full IOC sets are in each source advisory linked in the Sources section.

Mitigation & Defense

ScarCruft's consistent targeting of individuals rather than organizations presents a different defensive challenge from network perimeter-focused threats. The targets are people — researchers, journalists, policy professionals — whose job requires them to open documents from external sources, visit specialized websites, and engage with potentially unknown contacts. Defensive strategy must account for this legitimate operational context.

• Patch IE Mode and Legacy Rendering — Immediately: ScarCruft has exploited IE/Edge scripting engine zero-days in three consecutive years (2020, 2022, 2024). The August 2024 patch for CVE-2024-38178 must be applied to all Windows endpoints. Organizations should also audit what software in their environment uses IE-based rendering components — including legacy enterprise applications, advertisement software, and utilities with embedded WebView components — and either update those applications or remove them. Disabling IE Mode in Edge via Group Policy is a defensive measure for organizations that do not have legitimate IE compatibility requirements.
• Removable Media Controls for Air-Gapped Environments: The Ruby Jumper campaign specifically weaponizes the USB-based data transfer that air-gapped environments rely on. Organizations with air-gapped systems should implement hardware-level USB device controls that restrict which devices can connect, scan all removable media with dedicated security tools before use in isolated environments, and train personnel to recognize the warning sign that VIRUSTASK creates — files hidden and replaced by shortcuts on USB drives. Air-gap protocols should include visual inspection of USB drive contents before use on isolated systems.
• Monitor Cloud Storage Process Connections: ScarCruft routes all its C2 through legitimate cloud services. Blocking Dropbox, Google Drive, pCloud, Yandex, and Zoho WorkDrive at the network level is impractical for organizations that use these services. Instead, implement endpoint monitoring that identifies which processes are making API calls to cloud storage providers — a PowerShell script or an unexpected background process connecting to Dropbox is anomalous even if the destination is not blocked. Cloud-based C2 detection requires process lineage monitoring rather than destination-based blocking.
• LNK File Awareness and Controls: ScarCruft has consistently used malicious LNK files as its primary delivery vector for multiple years. Implement Group Policy to show file extensions for all file types, making disguised LNK files visible. Apply attack surface reduction rules that block the execution of potentially obfuscated scripts, including those launched from shortcut files. User awareness training for high-risk individuals (researchers, journalists, policy professionals, defector advocates) should specifically address the risks of LNK files received by email or messaging platforms.
• High-Risk Individual Security Programs: Journalists, academics, defectors, and advocacy workers who are ScarCruft primary targets require tailored security support beyond standard enterprise controls. Consider providing these individuals with hardened devices or browser isolation solutions for their highest-risk work. Threat intelligence briefings specifically addressing North Korean targeting of their community — the specific lure themes, delivery mechanisms, and warning signs — can significantly reduce successful phishing against individuals whose work requires engaging with external documents and sources.
• Audit Scheduled Tasks After Any Security Event: Ruby Jumper persists via a scheduled task named "rubyupdatecheck" — plausibly legitimate, hard to spot in a long list of scheduled tasks. Implement baseline monitoring of scheduled tasks: hash all existing scheduled tasks and alert on any new task creation. Any new scheduled task should be treated as a potential persistence mechanism requiring investigation, especially in high-risk environments.

Sources & Further Reading

Attribution and references used to build this profile.

• Zscaler ThreatLabz — APT37 Adds New Capabilities for Air-Gapped Networks (Ruby Jumper, December 2025)
• The Hacker News — ScarCruft Exploits Windows Zero-Day CVE-2024-38178 (Operation Code on Toast, 2024)
• The Hacker News — ScarCruft Uses RokRAT in Operation HanKook Phantom (September 2025)
• Recorded Future News — APT37 Espionage Campaign Targeting South Korea NK-Focused Organizations (2025)
• Recorded Future News — ScarCruft Targeting NK Affairs Experts and News Media (2024)
• Lookout — KoSpy Android Spyware Attributed to APT37 (2025)
• Google TAG — Internet Explorer Zero-Day Exploited by APT37 (CVE-2022-41128)
• MITRE ATT&CK — Group G0067: APT37